8. 401 - token revoked or expired

The token parsed correctly, but is either past its expiry timestamp or was revoked from the admin console. The engine treats both cases identically - the token is no longer trusted.

A bearer token whose exp claim is in the past, or whose ID has been added to the revocation set.

curl -X POST "https://$OC_HOST/v1/tenants/$OC_TENANT/sql" \
  -H "Authorization: Bearer eyJ...expired..." \
  -H "Content-Type: application/json" \
  -d '{"sql": "SELECT 1"}'

{
  "error": "unauthorized",
  "message": "token expired at 2026-04-30T12:00:00Z",
  "retry": false
}

• Issue a fresh token in the dashboard at /app/tokens and update your secret store.
• If the old token was revoked (security event), rotate any downstream consumers that share it.
• The SDKs surface this as a structured TokenExpiredError so you can wire automatic refresh in long-running services.
• retry: false - the same token will keep failing. Refresh first.